- add validation example

- update docs for validation

documentation/installation.md

@@ -25,4 +25,6 @@ To run Kyverno in a development environment see: https://github.com/nirmata/kyve
 To write and test policies without installing Kyverno in a Kubernetes cluster you can try the [Kyverno CLI](documentation/testing-policies-cli.md).
 
 
+
+---
 <small>*Read Next >> [Writing Policies](/documentation/writing-policies.md)*</small>

documentation/testing-policies.md

@@ -11,3 +11,6 @@
 
 
 
+
+---
+

documentation/writing-policies-generate.md

@@ -5,6 +5,6 @@
 
 
 
-
+---
 <small>*Read Next >> [Testing Policies](/documentation/testing-policies.md)*</small>
 

documentation/writing-policies-mutate.md

@@ -5,5 +5,5 @@
 
 
 
-
+---
 <small>*Read Next >> [Generate](/documentation/writing-policies-generate.md)*</small>

documentation/writing-policies-validate.md

@@ -3,8 +3,65 @@
 
 # Validate Configurations 
 
+A validation rule is expressed as an overlay pattern that expresses the desired configuration. Resource configurations must match fields and expressions defined in the pattern to pass the validation rule. The following rules are followed when processing the overlay pattern:
+
+1. Validation will fail if a field is defined in the pattern and if the field does not exist in the configuration. 
+2. Undefined fields are treated as wildcards. 
+3. A validation pattern field with the wildcard value '*' will match zero or more alphanumeric characters. Empty values or missing fields are matched.
+4. A validation pattern field with the wildcard value '?' will match any single alphanumeric character. Empty or missing fields are not matched. 
+5. A validation pattern field with the wildcard value '*?' will match any alphanumeric characters and requires the field to be present with non-empty values.
+6. A validation pattern field with the value `null` requires that the field not be defined or have a null value.
+6. The validation of siblings is performed only when one of the field values matches the value defined in the pattern. You can use the parenthesis operator to explictly specify a field value that must be matched. This allows writing rules like 'if fieldA equals X, then fieldB must equal Y'.
+7. Validation of child values is only performed if the parent matches the pattern.
+
+## Patterns
+
+### Wildcards
+1. `*` - matches zero or more alphanumeric characters
+2. `?` - maatches a single alphanumeric character
+
+### Operators
+
+| Operator   | Meaning                   |
+|------------|---------------------------| 
+| `>`        | greater than              | 
+| `<`        | less than                 | 
+| `>=`       | greater than or equals to |
+| `<=`       | less than or equals to    | 
+| `!`        | not equals                |
+| `|`        | logical or                |
+|  `&`       | logical and               |
+
+There is no operator for `equals` as providing a field value in the pattern requires equality to the value.
+
+## Example
+
+````yaml
+
+apiVersion : kyverno.io/v1alpha1
+kind : Policy
+metadata :
+  name : validation-example
+spec :
+  rules:
+    - resource:
+        # Kind specifies one or more resource types to match
+        kind: Deployment, StatefuleSet, DaemonSet
+        # Name is optional and can use wildcards
+        name: *
+        # Selector is optional
+        selector:
+      validate:
+        # Message is optional
+        message: "The label app is required"
+        pattern:
+          spec:
+            selector:
+              matchLabels:
+                app: ?*
+
+````
 
 
-
-
+---
 <small>*Read Next >> [Mutate](/documentation/writing-policies-mutate.md)*</small>

documentation/writing-policies.md

@@ -37,5 +37,8 @@ spec :
      ...
 ````
 
+Each rule can validate, mutate, or generate configurations of matching resources. A rule definition can contain only a single **validate**, **mutate**, or **generate** child node.
 
+
+---
 <small>*Read Next >> [Validate](/documentation/writing-policies-validate.md)*</small>

examples/Validate/check_not_root.yaml

@@ -0,0 +1,17 @@
+apiVersion : kyverno.io/v1alpha1
+kind : Policy
+metadata :
+  name : check-non-root
+spec :
+  rules:
+    - name: check-non-root
+      resource:
+        kind: Deployment, StatefuleSet, DaemonSet
+      validate:
+        message: "Root user is not allowed"
+        pattern:
+          spec:
+            template:
+              spec:
+                securityContext:
+                  runAsNotRoot: true